DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
422644d42dece64bd4625010e53bdeeb_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
422644d42dece64bd4625010e53bdeeb_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
422644d42dece64bd4625010e53bdeeb_JaffaCakes118
Size
42KB
MD5
422644d42dece64bd4625010e53bdeeb
SHA1
3edcf441184e08e76d81fe05f02fbe85e530df86
SHA256
3e5c14781ddd6a4f84d29dd4ce1136a241569be165276a805119af8f84962c44
SHA512
d749e43f1e5fe7ce7d61e9f867970bc94a4bfc04ad2771e2ab1d0e13f812ef69bd89a77e58c986189c9c7e7730b288978a8fc1707e691b4264351dc2d4ebc45f
SSDEEP
768:iTp/CpxQaKuAeg4NYwUiy+AVpNrSpiYczyuCOB4WSIQnjz8lt9+YX5O:4pqpjKuAeWR9Ea7B4Ng+YO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
422644d42dece64bd4625010e53bdeeb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ